The Seat · Fractional Leadership : One seat. One name. The whole mandate.
vCISO · vCTO · vCAIO · DPO — fractional, credentialed, accountable.
Technology without an owner is the exposure. Golonex holds that seat: a named vCISO, vCTO, vCAIO, or DPO — whichever the job needs — who owns technology, security, and compliance, directs whoever does the work, and signs for the result.
The disciplines converged. Most leadership didn’t.
ISO 42001 runs on the same management-system logic as ISO 27001. The EU AI Act and NIST 800-171 both turn on data protection, logging, and traceability. A security leader who cannot govern AI, or an AI advisor who is not a security practitioner, means paying twice and still owning the gap between them.
One credentialed, accountable executive across the whole mandate — technology, security, compliance, and AI. One owner, zero seams.
It does not matter who builds or who supplies talent. Your MSP stays. Your engineers stay. What changes is that one person now directs them against the framework and answers for the outcome.
Four seats. One owner — whichever the job needs.
Fractional Chief Information Security Officer
Owns the security program: the readiness reviews for CMMC, ISO 27001, and PCI DSS, the System Security Plan and Statement of Applicability, the evidence, and the relationship with the C3PAO, the QSA, or the certification body.
Fractional Chief Technology Officer
Owns the technology estate and every vendor in it — cloud, identity, endpoints, backup, the MSP — and the decisions about what gets built, by whom, and to what standard.
Fractional Chief AI Officer
Owns the AI inventory, provider-versus-deployer mapping, risk classification, human-oversight controls, and the logging that proves how your systems behave — the EU AI Act and ISO 42001 conformity work.
Data Protection Officer of record
Owns personal-data obligations where the law requires a named officer: data mapping, rights requests, breach notification, processor contracts, and the board interface. DPDP Act obligations in India run through our India branch.
Why fractional works: these seats are expensive to hire, hard to find in the security-and-AI combination, and most firms only need a fraction of one. The seat is scoped by mandate and priced as a fixed monthly seat, both written down before work begins.
The mandate map.
Every capability a regulated firm needs is a mandate the seat oversees — delivered by Golonex or by the vendor you already have. The full map, organised the way assessors organise it, is on its own page.
- Assessment and readiness reviews
- Security program development and the ISMS
- Governance, risk, and third-party risk
- Monitoring, detection, and response
- Penetration testing and phishing simulation
- Managed IT security — identity, endpoints, email, backup, cloud
- Security awareness and training
- Incident response and digital forensics
What the seat directs. One owner either way.
Readiness reviews
Scope, assess, close the gaps, assemble the evidence, walk in prepared. CMMC / NIST 800-171, EU AI Act, ISO 42001, ISO 27001, PCI DSS — one control program crosswalked across all of them.
All readiness reviews →Managed delivery
When the work has to be built or run, Golonex does it: seven practices — talent, software, infrastructure, security assurance, Microsoft, process & AI automation, and a managed GCC in India — a named engineer or a dedicated team, one accountable lead. A Golonex lead on every engagement, staffed with managed talent, at fixed monthly seat pricing.
Managed software delivery →Your existing vendors
Your MSP, your cloud provider, your developers, your outside counsel. The seat directs them, checks their work against the framework, and signs for the result. Nobody has to be replaced for the seat to work.
What the seat oversees →The technology seat, held fractionally.
One owner for security, compliance, and the people who run them. The seat comes with the work that proves it is filled.
Included
- The seat on your org chart — a named vCISO, vCTO, vCAIO, or DPO who answers to your board
- A 90-day baseline assessment against the frameworks you are held to
- The System Security Plan and POA&M — or the equivalent for your framework
- The policy set, written for the team that has to follow it
- A one-page monthly report, signed by the seat-holder
- Vendor oversight — your MSP, your cloud, your software suppliers
- Oversight of the day-to-day — your Microsoft 365, EDR, backup, and patching vendors held to the framework; assurance that their controls work is a separate seat Security assurance →
- A quarterly re-assessment so readiness is a state, not a date
- Cyber and AI-literacy training with attendance evidence
How it is scoped
In writing, before kickoff: the frameworks in scope, the mandates the seat owns, and the monthly price. When the work includes a build, it is scoped on its own through managed software delivery.
Four things the seat-holder does that a tool cannot.
The knowing part of compliance is cheap now. The part that costs something is a named person who signs, shows up, holds the seat, and reports.
Signs
Your seat-holder’s name goes on the System Security Plan, the Statement of Applicability, the DPIA, the risk register, and the monthly report. You know whose name it is before you sign anything.
Faces
In the room with the C3PAO, the QSA, the certification auditor, and the prime’s security team. Not a slide sent ahead.
Holds
A seat on your org chart, with the reporting line to match. DPO-of-record where the law requires one.
Reports
One page, every month, signed. What changed, what is open, what the board needs to decide.
Accountability is real, and it is bounded. It is scoped per engagement and never unlimited. The specific terms are set per engagement and walked through on the first call.
Fractional Leadership — your questions, answered
What is Fractional Leadership? +
Golonex holds the security and technology leadership seat in your company on a fractional basis. A named executive — vCISO, vCTO, vCAIO, or DPO, whichever the job needs, with the others available under it — owns technology, security, and compliance, oversees delivery, reports to your board, and puts a name on the evidence. It is the seat, not a service catalogue: everything else Golonex does is a mandate the seat oversees.
Why fractional instead of hiring a full-time CISO or CTO? +
A CISO or CTO with genuine compliance and AI-governance credentials is expensive, takes months to find, and most firms under $50M need a fraction of that person’s attention — not a full-time headcount. The seat gives you the same accountability at a fraction of the cost, with a defined scope so you know exactly what is covered and what is not.
What is the seat-holder accountable for, specifically? +
Program and readiness ownership, scoped upfront: the gap assessment and remediation roadmap, the System Security Plan and Statement of Applicability, the policy set, assessment preparation, vendor oversight, and a signed monthly report to the board. Accountability is real, and it is bounded. It is scoped per engagement and never unlimited. The specific terms are set per engagement and walked through on the first call.
Is managed delivery part of the seat? +
The seat directs; managed delivery does. When the work has to be built or run, the seat can bring any of the seven managed practices — managed talent, software delivery, infrastructure, security assurance, the Microsoft estate, process & AI automation, or a managed GCC in India — each priced separately by seat. It does not matter who builds or who supplies talent: the seat owns the outcome either way.
Can you work alongside our existing IT provider or legal team? +
That is the most common arrangement. The seat-holder sits above your IT provider, your MSP, and your outside counsel — attending the relevant committee meetings, reviewing vendor contracts, and directing the work rather than replacing the people. The scope is written so internal and external responsibilities do not overlap.
Do you also provide a DPO for India? +
Yes. Where the DPDP Act requires a named, India-resident Data Protection Officer, our India branch provides one — data mapping, consent oversight, rights requests, breach notification, processor contracts, and the board interface. The full DPDP scope is on the India page.
Put a name on your security and compliance.
Thirty minutes tells you which seat you need, what it owns, and what the first ninety days look like.